Virginia National Bankshares Corp (VABK) Risk Factors

Item 1A. RISK FACTORS.

The Company’s business is subject to risk. The following discussion, along with management’s discussion and analysis, the information contained in “Forward-Looking Statements and Factors that Could Affect Future Results,” and the financial statements and footnotes, sets forth the most significant risks and uncertainties that management believes could adversely affect the Company’s future business, financial condition or results of operations, and that investors in the Company’s securities should carefully consider. References to past events in these risk factors are provided by way of example only and are not intended to be a complete listing or a representation as to whether or not such factors have occurred in the past or their likelihood of occurring in the future. Additional risks and uncertainties that management is not aware of or that management currently deems immaterial may also have a material adverse effect on the Company’s business, financial condition or results of operations. There is no assurance that this discussion covers all potential risks that the Company may face.

Credit Risks

The Company’s credit standards and its on-going credit assessment processes might not protect it from significant credit losses.

The Company assumes credit risk by virtue of making loans and extending loan commitments and letters of credit. The Company manages credit risk through a program of underwriting standards, the review of certain credit decisions and a continuous quality assessment process of credit already extended. The Company’s exposure to credit risk is managed through the use of consistent underwriting standards that emphasize local lending while avoiding highly leveraged transactions, as well as excessive industry and other concentrations. The Company’s credit administration function employs risk management techniques to help ensure that problem loans are promptly identified. While these procedures are designed to provide the Company with the information needed to implement policy adjustments where necessary and to take appropriate corrective actions, there can be no assurance that such measures will be effective in avoiding undue credit risk.

The Company’s ACL may be insufficient and any increases in the ACL may have a material adverse effect on the Company’s financial condition and results of operations.

On January 1, 2023, the Company adopted ASC 326, more commonly referred to as "CECL," which replaced prior accounting principles for the recognition of loan losses based on losses that have been incurred with a requirement to record an allowance for credit losses that represents expected credit losses over the lifetime of all loans in the Company’s portfolio. Under ASC 326, the Company’s estimate of expected credit losses is based on reasonable and supportable forecasts of future economic conditions and loan performance.

The level of the ACL reflects management’s evaluation of the level of loans outstanding, the level of nonperforming loans, historical loan loss experience, delinquency trends, underlying collateral values, the amount of actual losses charged to the reserve in a given period and assessment of present and anticipated economic conditions. The determination of the appropriate level of the ACL inherently involves a high degree of subjectivity and requires the Company to make significant estimates of credit risks and future trends, all of which could undergo material changes. Although the Company believes the ACL is a reasonable estimate of known and inherent losses in the loan portfolio, it cannot precisely predict such losses or be certain that the ACL will be adequate in the future. Deterioration of economic conditions affecting borrowers, new information regarding existing loans, identification of additional problem loans and other factors, both within and outside the Company’s control, may require an increase in the ACL. In addition, bank regulatory agencies and the Company’s auditors periodically review its ACL and may require an increase in the provision for credit losses or the recognition of further loan charge-offs, based on judgments different from those of management.

19

The Company’s focus on lending to small to mid-sized community-based businesses may increase its credit risk.

Most of the Company’s commercial business and commercial real estate loans are made to small and mid-sized businesses and 501(c)3 organizations. These businesses generally have fewer financial resources in terms of capital or borrowing capacity than larger entities and have a heightened vulnerability to economic conditions. If general economic conditions in the market areas in which the Company operates negatively impact this important customer sector, the Company’s results of operations and financial condition may be adversely affected. Moreover, a portion of these loans have been made by the Company in recent years and the borrowers may not have experienced a complete business or economic cycle. Any deterioration of the borrowers’ businesses may hinder their ability to repay their loans with the Company, which could have a material adverse effect on its financial condition and results of operations. Steps to mitigate such risks include underwriting multiple sources of repayment, including but not limited to, business cash flow, personal guarantees, collateral, and government guarantees, where applicable. Although the Company has taken these mitigation steps, there is no guarantee that such practices will be effective to prevent the increased credit risk.

The Company’s concentration in loans secured by real estate may increase its future credit losses, which would negatively affect the Company’s financial results.

The Company offers a variety of secured loans, including commercial lines of credit, commercial term loans, real estate, construction, home equity, consumer and other loans. Credit risk and credit losses can increase if its loans are concentrated to borrowers who, as a group, may be uniquely or disproportionately affected by economic or market conditions. As of December 31, 2025, approximately 76.4% of the Company’s loans are secured by real estate, both residential and commercial. The Company has established concentration limits that are regularly monitored by management and reported to the Board. A major change in the real estate market in the regions in which the Company operates, resulting in a deterioration in real estate values, or in the local or national economy, could adversely affect the Company’s customers’ ability to pay these loans, which in turn could adversely impact the Company. Risk of loan defaults and foreclosures are inherent in the banking industry, and the Company tries to limit its exposure to this risk by carefully underwriting and monitoring its extensions of credit. The Company cannot fully eliminate credit risk, and as a result, credit losses may occur in the future.

The Company has a moderate concentration of credit exposure in commercial real estate and loans with this type of collateral are viewed as having higher risk of default.

As of December 31, 2025, the Company had approximately $496.5 million in loans secured by non-owner occupied commercial real estate, which represented approximately 40.1% of total loans outstanding at that date and 247% of regulatory capital. Such category of loans consists of $333.7 million of non-owner occupied commercial real estate, $127.8 million of multifamily and $35.0 million of construction, land development and other land loans. These types of loans are generally viewed as having higher risk of default than residential real estate loans. They are also typically larger than residential real estate loans and consumer loans and depend on cash flows from the property to service the debt, successful completion of construction projects and, for development loans, sale of the underlying asset. It may be more difficult for commercial real estate borrowers to repay their loans in a timely manner, as commercial real estate borrowers’ abilities to repay their loans frequently depend on the successful rental of their properties. Some degree of instability in the commercial real estate markets is expected in the coming quarters as loans are refinanced in markets with higher vacancy rates under current economic conditions. The outlook for commercial real estate remains dependent on the broader economic environment and, specifically, how major subsectors respond to a higher interest rate environment and higher prices for commodities, goods and services. Cash flows may be affected significantly by general economic conditions, and a sustained downturn in the local economy or in occupancy rates in the local economy where the property is located could increase the likelihood of default. Because the Company’s loan portfolio contains a number of commercial real estate loans with relatively large balances, the deterioration of one or a few of these loans could cause a significant increase in its percentage of nonperforming loans. An increase in nonperforming loans could result in a loss of earnings from these loans, an increase in the provision for credit losses and an increase in charge-offs, all of which could have a material adverse effect on the Company’s financial condition. The Company’s banking regulators generally give commercial real estate lending greater scrutiny and may require banks with higher levels of commercial real estate loans to implement improved underwriting, internal controls, risk management policies and portfolio stress testing, as well as possibly higher levels of ACL and capital as a result of commercial real estate lending growth and exposures, which could have a material adverse effect on the Company’s results of operations. Steps to mitigate such risks include underwriting multiple sources of repayment, including but not limited to, business cash flow, personal guarantees, collateral, and government guarantees, where applicable. In addition, the Company has established concentration limits that are regularly monitored by management and reported to

20

the Board. Although the Company has taken these mitigation steps, there is no guarantee that such practices will be effective to prevent the increased credit risk.

The Company’s results of operations are significantly affected by the ability of borrowers to repay their loans.

A significant source of risk for the Company is the possibility that losses will be sustained because borrowers, guarantors and related parties may fail to perform in accordance with the terms of their loan agreements. Most of the Company’s loans are secured but some loans are unsecured. With respect to the secured loans, the collateral securing the repayment of these loans may be insufficient to cover the obligations owed under such loans. Collateral values may be adversely affected by changes in economic, environmental and other conditions, declines in the value of real estate, changes in interest rates, changes in monetary and fiscal policies of the federal government, terrorist activity, environmental contamination and other external events. In addition, collateral appraisals that are out of date or that do not meet industry-recognized standards may create the impression that a loan is adequately collateralized when it is not. The Company has adopted underwriting and credit monitoring procedures and policies, including regular reviews of appraisals and borrower financial statements, that management believes are appropriate to mitigate the risk of loss. An increase in nonperforming loans could result in a net loss of earnings from these loans, an increase in the provision for credit losses and an increase in loan charge-offs, all of which could have a material adverse effect on the Company’s financial condition and results of operations.

Market Risks

The Company may be adversely impacted by changes in market conditions.

The Company is directly and indirectly affected by changes in market conditions. Market risk generally represents the risk that values of assets and liabilities or revenues will be adversely affected by changes in market conditions. As a financial institution, market risk is inherent in the financial instruments associated with the Company’s operations and activities, including loans, deposits, securities, and short-term borrowings. A few of the market conditions that may shift from time-to-time, thereby exposing the Company to market risk, include fluctuations in interest rates, equity and futures prices, and price deterioration or changes in value due to changes in market perception or actual credit quality of issuers. The Company’s investment securities portfolio, in particular, may be impacted by market conditions beyond its control, including rating agency downgrades of the securities, defaults of the issuers of the securities, lack of market pricing of the securities, and inactivity or instability in the credit markets. Any changes in these conditions, in current accounting principles or interpretations of these principles could impact the Company’s assessment of fair value and thus the determination of the need for an allowance for credit loss on securities in the investment securities portfolio, which could adversely affect the Company’s earnings and capital ratios.

Weaknesses in economic or market conditions, or adverse developments in the financial services industry, could pose challenges for the Company and could adversely affect the results of operations, liquidity, and financial condition.

Deterioration in, or uncertain, economic conditions could adversely affect the Company’s business which is directly affected by general economic and market conditions; broad trends in industry and finance; legislative and regulatory changes; changes in governmental monetary and fiscal policies, including trade policies and tariffs; and inflation, all of which are beyond the Company’s control. Prolonged periods of inflation may impact profitability by negatively impacting fixed costs and expenses, including increasing funding costs and expense related to talent acquisition and retention, and negatively impacting the demand for products and services. Additionally, inflation may lead to a decrease in consumer and commercial purchasing power and an increase in default rates on loans. Any deterioration in economic conditions, in particular a prolonged economic slowdown within the Company’s geographic region or a broader disruption in the economy, possibly as a result of a pandemic or other widespread public health emergency, acts of terrorism, or outbreak of domestic or international hostilities (including the ongoing military conflicts between Russia and Ukraine and in the Middle East), or unanticipated events in the banking industry, such as high-profile bank failures in 2023, could result in the following consequences, any of which could hurt business materially: declines in real estate values and home sales and increases in the financial stress on borrowers and unemployment rates, all of which could lead to increases in loan delinquencies, problem assets and foreclosures, and a deterioration in the value of collateral for loans made by the Company's various business segments; an increase in the level of loan losses exceeding the level the Company has provided in its ACL, which would reduce the Company’s earnings; a decline in demand for the Company's products and services; changes in the fair value of financial instruments held by the Company or its subsidiaries; or declines in available sources or amounts of liquidity and funding. Events in the financial services industry, such as the high-profile bank failures in 2023, may also cause concern and uncertainty about the financial services industry generally, which may result in sudden deposit outflows, increased

21

borrowing and funding costs, and increased competition for liquidity, any of which could have a material adverse impact on the Company’s business, financial condition, and results of operations.

Inflation can have an adverse impact on the Company’s business and on its customers.

During 2022, the United States experienced the highest level of inflation since the 1980s. In response, the Federal Reserve increased the federal funds target rate at the fastest pace in over 40 years, increasing 425 bps during 2022 and an additional 100 bps in 2023, before declining during 2024 and 2025. Price-wage inflation may cause the Company to give higher than normal raises to employees and start new employees at a higher wage. Furthermore, the Company’s customers are also affected by inflation and the rising costs of goods and services used in their households and businesses, which could have a negative impact on their ability to repay their loans with the Company. As market interest rates rise, the value of the Company’s investment securities generally decreases, although this effect can be less pronounced for floating rate instruments. Higher interest rates reduce the demand for loans and increase the attractiveness of alternative investment and savings products, like U.S. Treasury securities and money market funds, which can make it difficult to attract and retain deposits.

The Company’s business is subject to interest rate risk, and variations in interest rates and inadequate management of interest rate risk may negatively affect financial performance.

Changes in the interest rate environment may reduce the Company’s profits. It is expected that the Company will continue to realize income from the differential or “spread” between the interest earned on loans, securities, and other interest-earning assets, and interest paid on deposits, borrowings and other interest bearing liabilities. Net interest spreads are affected by the difference between the maturities and repricing characteristics of interest-earning assets and interest bearing liabilities. In addition, loan volume and yields are affected by market interest rates on loans, and the current interest rate environment encourages extreme competition for new loan originations from qualified borrowers. The Company’s management cannot ensure that it can minimize interest rate risk. If the interest rates paid on deposits and other borrowings increase at a faster rate than the interest rates received on loans and other investments, the Company’s net interest income, and therefore earnings, could be adversely affected. Earnings could also be adversely affected if the interest rates received on loans and other investments fall more quickly than the interest rates paid on deposits and other borrowings. Accordingly, changes in levels of market interest rates could materially and adversely affect the net interest spread, asset quality, loan origination volume and the Company’s overall profitability.

The Company relies upon independent appraisals to determine the value of the real estate that secures a significant portion of its loans and the value of any foreclosed properties that may be carried on its books, and the values indicated by such appraisals may not be realizable if it is forced to foreclose upon such loans or liquidate such foreclosed property.

As indicated above, a significant portion of the Company’s loan portfolio consists of loans secured by real estate and it may also hold foreclosed properties from time-to-time. The Company relies upon independent appraisers to estimate the value of such real estate. Appraisals are only estimates of value and the independent appraisers may make mistakes of fact or judgment that adversely affect the reliability of their appraisals. In addition, events occurring after the initial appraisal may cause the value of the real estate to increase or decrease. As a result of any of these factors, the real estate securing some of the Company’s loans and any foreclosed properties that may be held by the Company may be more or less valuable than anticipated. If a default occurs on a loan secured by real estate that is less valuable than originally estimated, the Company may not be able to recover the outstanding balance of the loan. It may also be unable to sell any foreclosed properties for the values estimated by their appraisals. The Company had no foreclosed property as of December 31, 2025 or December 31, 2024.

22

Liquidity Risks

The Company’s liquidity needs could adversely affect results of operations and financial condition.

The Company’s primary sources of funds are deposits and loan repayments. While scheduled loan repayments are a relatively stable source of funds, they are subject to the ability of borrowers to repay the loans. The ability of borrowers to repay loans can be adversely affected by a number of factors, including, but not limited to, changes in economic conditions, adverse trends or events affecting business industry groups, reductions in real estate values or markets, availability of, and/or access to, sources of refinancing, business closings or lay-offs, pandemics or endemics, inclement weather, natural disasters and international instability. Deposit levels may be affected by a number of factors, including, but not limited to, rates paid by competitors, general interest rate levels, regulatory capital requirements, returns available to customers on alternative investments and general economic conditions. Additionally, negative news about the Company or the banking industry in general could negatively impact market and/or customer perceptions of the Company, which could lead to a loss of depositor confidence and an increase in deposit withdrawals, particularly among those with uninsured deposits. Furthermore, as many regional banking organizations experienced in 2023, the failure of other financial institutions may cause deposit outflows as customers spread deposits among several different banks so as to maximize their amount of FDIC insurance, move deposits to banks deemed “too big to fail” or remove deposits from the banking system entirely. As of December 31, 2025, approximately 27.4% of the Company's deposits were uninsured and the Company relies on these deposits for liquidity. Accordingly, the Company may be required from time-to-time to rely on secondary sources of liquidity to meet withdrawal demands or otherwise fund operations. Such sources include FHLB advances, sales of securities and loans, federal funds lines of credit from correspondent banks and borrowings from the Federal Reserve Discount Window, as well as additional out-of-market time deposits and brokered deposits. While the Company believes that these sources are currently adequate, there can be no assurance they will be sufficient or available to meet future liquidity demands, particularly if the Company continues to grow and experiences increasing loan demand. The Company may be required to slow or discontinue loan growth, capital expenditures or other investments, or liquidate assets should such sources not be adequate.

The Company may need to raise additional capital in the future and may not be able to do so on acceptable terms, or at all.

Access to sufficient capital is critical in order to enable the Company to implement its business plan, support its business, expand its operations and meet applicable capital requirements. The inability to have sufficient capital, whether internally generated through earnings or raised in the capital markets, could adversely impact the Company’s ability to support and to grow its operations. If the Company grows its operations faster than it generates capital internally, it will need to access the capital markets. The Company may not be able to raise additional capital in the form of additional debt or equity on acceptable terms, or at all. The Company’s ability to raise additional capital, if needed, will depend on, among other things, conditions in the capital markets at that time, the Company’s financial condition and its results of operations. Economic conditions and a loss of confidence in financial institutions may increase the Company’s cost of capital and limit access to some sources of capital. Further, if the Company needs to raise capital in the future, it may have to do so when many other financial institutions are also seeking to raise capital and would then have to compete with those institutions for investors. An inability to raise additional capital on acceptable terms when needed could have a material adverse impact on the Company’s business, financial condition and results of operations.

23

Strategic Risks

The Company faces strong and growing competition from financial institutions and other companies that offer banking and other financial services, which could negatively affect the Company’s business.

The Company encounters substantial competition from other financial institutions in its market area and competition is increasing. Ultimately, the Company may not be able to compete successfully against current and future competitors. Many competitors offer the same banking services that the Company offers in its service area. These competitors include national, regional and community banks. The Company also faces competition from many other types of financial services companies, including finance companies, mutual and money market fund providers, brokerage firms, insurance companies, credit unions, financial subsidiaries of certain industrial corporations and financial technology companies. Increased competition may result in reduced business for the Company.

Additionally, banks and other financial institutions with larger capitalization and financial intermediaries not subject to bank regulatory restrictions have larger lending limits and are thereby able to serve the credit needs of larger customers. Areas of competition include interest rates for loans and deposits, efforts to obtain loans and deposits, and range and quality of products and services provided, including new technology-driven products and services. If the Company is unable to attract and retain banking customers, it may be unable to continue to grow loan and deposit portfolios and its results of operations and financial condition may otherwise be adversely affected.

The Company may not be able to successfully manage its long-term growth, which may adversely affect its results of operations and financial condition.

The Company’s ability to continue to grow depends, in part, upon its ability to (i) open new branch offices or acquire existing branches or other financial institutions, (ii) attract deposits to those locations, and (iii) identify attractive loan and investment opportunities.

The Company may not be able to successfully implement its growth strategy if it is unable to identify attractive markets, locations or opportunities to expand in the future, or if the Company is subject to regulatory restrictions on growth or expansion of its operations. The Company’s ability to manage its growth successfully also will depend on whether it can maintain capital levels adequate to support its growth, maintain cost controls and asset quality and successfully integrate any businesses the Company acquires into its organization. As the Company identifies opportunities to implement its growth strategy by opening new branches or acquiring branches or other banks, it may incur increased personnel, occupancy and other operating expenses. In the case of new branches, the Company must absorb those higher expenses while it begins to generate new deposits, and there is a further time lag involved in redeploying new deposits into attractively priced loans and other higher yielding assets.

The Company may consider acquiring other businesses or expanding into new product lines that it believes will help it fulfill its strategic objectives. The Company expects that other banking and financial companies, some of which have significantly greater resources, will compete with it to acquire financial services businesses. This competition could increase prices for potential acquisitions that the Company believes are attractive. Acquisitions may also be subject to various regulatory approvals. If the Company fails to receive the appropriate regulatory approvals, it will not be able to consummate acquisitions that it believes are in its best interests.

When the Company enters into new markets or new lines of business, its lack of history and familiarity with those markets, customers and lines of business may lead to unexpected challenges or difficulties that inhibit its success. The Company’s plans to expand could depress earnings in the short run, even if it efficiently executes a growth strategy leading to long-term financial benefits.

24

Operational Risks

The Company is subject to a variety of operational risks, including reputational risk, legal and compliance risk, and the risk of fraud or theft by employees or outsiders.

The Company is exposed to many types of operational risks, including reputational risk, legal and compliance risk, the risk of fraud or theft by employees or outsiders, unauthorized transactions by employees, operational errors, clerical or record-keeping errors, and errors resulting from faulty or disabled computer or communications systems.

Reputational risk, or the risk to the Company’s earnings and capital from negative public opinion, could result from the Company’s actual or alleged conduct in any number of activities, including lending practices, corporate governance, and from actions taken by government regulators and community organizations in response to those activities. Negative public opinion can adversely affect the Company’s ability to attract and keep customers and employees and can expose it to litigation and regulatory action.

Further, if any of the Company’s financial, accounting, or other data processing systems fail or have other significant issues, the Company could be adversely affected. The Company depends on internal systems and outsourced technology to support these data storage and processing operations. The Company’s inability to use or access these information systems at critical points in time could unfavorably impact the timeliness and efficiency of the Company’s business operations. It could be adversely affected if one of its employees causes a significant operational break-down or failure, either as a result of human error or where an individual purposefully sabotages or fraudulently manipulates its operations or systems. The Company is also at risk of the impact of natural disasters, terrorism and international hostilities on its systems and from the effects of outages or other failures involving power or communications systems operated by others. The Company may also be subject to disruptions of its operating systems arising from events that are wholly or partially beyond its control (for example, computer viruses or electrical or communications outages), which may give rise to disruption of service to customers and to financial loss or liability. In addition, there have been instances where financial institutions have been victims of fraudulent activity in which criminals pose as customers to initiate wire and automated clearinghouse transactions out of customer accounts. Although the Company has policies and procedures in place to verify the authenticity of its customers, it cannot guarantee that such policies and procedures will prevent all fraudulent transfers. Such activity can result in financial liability and harm to the Company’s reputation. If any of the foregoing risks materialize, it could have a material adverse effect on the Company’s business, financial condition and results of operations.

Failure to maintain effective systems of internal and disclosure control could have a material adverse effect on the Company’s results of operation and financial condition.

Effective internal and disclosure controls are necessary for the Company to provide reliable financial reports and effectively prevent fraud and to operate successfully as a public company. The Company is also required to establish and maintain an adequate internal control structure over financial reporting pursuant to regulations of the FDIC. As a public company, the Company is required by the Sarbanes-Oxley Act to design and maintain a system of internal control over financial reporting and include management’s assessment regarding internal control over financial reporting. If the Company cannot provide reliable financial reports or prevent fraud, its reputation and operating results would be harmed. As part of the Company’s ongoing monitoring of internal control, it may discover material weaknesses or significant deficiencies in its internal control that require remediation. A “material weakness” is a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of a company’s annual or interim financial statements will not be prevented or detected on a timely basis.

The Company’s inability to maintain the operating effectiveness of the controls described above could result in a material misstatement to the Company’s financial statements or other disclosures, which could have an adverse effect on its business, financial condition or results of operations. In addition, any failure to maintain effective controls or to timely effect any necessary improvement of the Company’s internal and disclosure controls could, among other things, result in losses from fraud or error, harm the Company’s reputation or cause investors to lose confidence in its reported financial information, all of which could have a material adverse effect on its results of operation and financial condition.

The Company depends on the accuracy and completeness of information about customers and counterparties, and the Company’s financial condition could be adversely affected if it relies on misleading or incorrect information.

25

In deciding whether to extend credit or to enter into other transactions with customers and counterparties, the Company may rely on information furnished to it by or on behalf of customers and counterparties, including financial statements and other financial information, which it does not independently verify. The Company also may rely on representations of customers and counterparties as to the accuracy and completeness of that information and, with respect to financial statements, on reports of independent auditors. For example, in deciding whether to extend credit to customers, the Company may assume that a customer’s audited financial statements conform with GAAP and present fairly, in all material respects, the financial condition, results of operations and cash flows of that customer. The Company’s financial condition and results of operations could be negatively impacted to the extent it relies on financial statements that do not comply with GAAP or are materially misleading.

The Company’s success depends on its management team, and the unexpected loss of any of these personnel could adversely affect operations.

The Company’s success is, and is expected to remain, highly dependent on its management team. This is particularly true because, as a community bank, the Company depends on the management team’s ties to the community and customer relationships to generate business. The Company’s growth will continue to place significant demands on management, and the loss of any such person’s services may have an adverse effect upon growth and profitability. If the Company fails to retain or continue to recruit qualified employees, growth and profitability could be adversely affected.

The Company relies on other companies to provide key components of its business infrastructure.

Third parties provide key components of the Company’s business operations such as data processing, recording and monitoring transactions, online banking interfaces and services, internet connections and network access. While the Company has performed due diligence and selected these third-party vendors carefully, it does not control their actions. Any problem caused by these third parties, including poor performance of services, failure to provide services, disruptions in communication services provided by a vendor and failure to handle current or higher volumes, could adversely affect the Company’s ability to deliver products and services to its customers and otherwise conduct its business, and may harm its reputation. Financial or operational difficulties of a third-party vendor could also hurt the Company’s operations if those difficulties interfere with the vendor’s ability to serve the Company. Replacing these third-party vendors could also create significant delay and expense. Accordingly, use of such third-parties creates an unavoidable inherent risk to the Company’s business operations.

The soundness of other financial institutions could adversely affect the Company.

The Company’s ability to engage in routine funding transactions could be adversely affected by the actions and commercial soundness of other financial institutions. Financial services institutions are interrelated as a result of trading, clearing, counterparty or other relationships. The Company has exposure to many different industries and counterparties, and routinely executes transactions with counterparties in the financial industry. As a result, defaults by, or even rumors or questions about, one or more financial services institutions, or the financial services industry generally, have led to market-wide liquidity problems and could lead to losses or defaults by the Company or by other institutions. Many of these transactions expose the Company to credit risk in the event of default of its counterparty or customer. In addition, credit risk may be exacerbated when the collateral held cannot be realized upon or is liquidated at prices insufficient to recover the full amount of the financial instrument exposure due. There is no assurance that any such losses would not materially and adversely affect results of operations.

The Company’s operations may be adversely affected by cybersecurity risks.

In the ordinary course of business, the Company collects and stores sensitive data, including proprietary business information and personally identifiable information related to its customers and employees in systems and on networks. The secure processing, maintenance, and use of this information is critical to operations and the Company’s business strategy. The Company has invested in accepted technologies, and continually reviews processes and practices that are designed to protect its networks, computers, and data from damage or unauthorized access. Despite these security measures, the Company’s computer systems and infrastructure may be vulnerable to attacks by hackers or breached due to employee error, malfeasance or other disruptions. A breach of any kind could compromise systems and the information stored there could be accessed, damaged or disclosed. A breach in security could result in legal claims, regulatory penalties, disruption in operations, and damage to the Company’s reputation, which could adversely affect its business and financial condition. Furthermore, as cyber threats continue to evolve and increase, the Company may be required to expend significant

26

additional financial and operational resources to modify or enhance its protective measures, or to investigate and remediate any identified information security vulnerabilities.

In addition, multiple major U.S. retailers have experienced data systems incursions reportedly resulting in the thefts of credit and debit card information, online account information and other financial or privileged data. Retailer incursions affect cards issued and deposit accounts maintained by many banks, including the Bank. Although the Company’s systems are not breached in retailer incursions, these events can cause it to reissue a significant number of cards and take other costly steps to avoid significant theft loss to the Company and its customers. In some cases, the Company may be required to reimburse customers for the losses they incur. Other possible points of intrusion or disruption not within the Company’s control include internet service providers, electronic mail portal providers, social media portals, distant-server (cloud) service providers, electronic data security providers, data processing service providers, telecommunications companies, and smart phone manufacturers.

Consumers may increasingly decide not to directly use banks to complete their financial transactions, which would have a material adverse impact on the Company’s financial condition and operations.

Technology and other changes are allowing parties to complete financial transactions through alternative methods that historically have involved banks. For example, consumers can now maintain funds that would have historically been held as bank deposits in brokerage accounts, mutual funds, general-purpose reloadable prepaid cards, or in other types of assets, including cryptocurrencies or other digital assets. Consumers can also complete transactions such as paying bills or transferring funds directly without the assistance of banks. The process of eliminating banks as intermediaries, known as “disintermediation,” could result in the loss of fee income, as well as the loss of customer deposits and the related income generated from those deposits. The loss of these revenue streams and the loss of deposits as a lower cost source of funds could have a material adverse effect on the Company's financial condition and results of operations.

The Company’s ability to operate profitably may be dependent on its ability to integrate or introduce various technologies into its operations.

The market for financial services, including banking and consumer finance services, is increasingly affected by advances in technology, including developments in telecommunications, data processing, computers, automation, online banking and tele-banking. The Company’s ability to compete successfully in its market may depend on the extent to which it is able to implement or exploit such technological changes. If the Company is not able to afford such technologies, properly or timely anticipate or implement such technologies, or effectively train its staff to use such technologies, its business, financial condition or operating results could be adversely affected.

The development and use of Artificial Intelligence (“AI”) presents risks and challenges that may adversely impact the Company’s business.

The Company or its third-party vendors, clients, or counterparties may develop or incorporate AI technology in certain business processes, services, or products. The development and use of AI presents a number of risks and challenges to the Company’s business. The legal and regulatory environment relating to AI is uncertain and rapidly evolving, and includes regulatory schemes targeted specifically at AI as well as provisions in intellectual property, privacy, consumer protection, employment, and other laws applicable to the use of AI. These evolving laws and regulations could require changes in the Company’s implementation of AI technology and increase the Company’s compliance costs and the risk of non-compliance. AI models, particularly generative AI models, may produce output or take action that is incorrect, that reflects biases included in the data on which they are trained, that results in the release of private, confidential, or proprietary information, that infringes on the intellectual property rights of others, or that is otherwise harmful. In addition, the complexity of many AI models makes it difficult to understand why they are generating particular outputs. This limited transparency increases the challenges associated with assessing the proper operation of AI models, understanding and monitoring the capabilities of the AI models, reducing erroneous outputs, eliminating bias, and complying with regulations that require documentation or explanation of the basis on which decisions are made. Further, the Company may rely on AI models developed by third parties, and, to that extent, would be dependent in part on the manner in which those third parties develop and train their models, including risks arising from the inclusion of any unauthorized material in the training data for their models and the effectiveness of the steps these third parties have taken to limit the risks associated with the output of their models, matters over which the Company may have limited visibility. Any of these risks could expose the Company to liability or adverse legal or regulatory consequences and harm the Company’s reputation and the public perception of its business or the effectiveness of its security measures.

27

Legal, Regulatory and Compliance Risks

The Company operates in a highly regulated industry and the laws and regulations that govern the Company’s operations, corporate governance, executive compensation and financial accounting, or reporting, including changes in them or the Company’s failure to comply with them, may adversely affect the Company.

The Company is subject to extensive regulation and supervision that govern almost all aspects of its operations. These laws and regulations, among other matters, prescribe minimum capital requirements, impose limitations on the Company’s business activities, limit the dividends or distributions that it can pay, restrict the ability of institutions to guarantee its debt and impose certain specific accounting requirements that may be more restrictive and may result in greater or earlier charges to earnings or reductions in its capital than GAAP. Compliance with laws and regulations can be difficult and costly, and changes to laws and regulations often impose additional compliance costs.

The Dodd-Frank Act instituted major changes to the banking and financial institutions regulatory regimes. Other changes to statutes, regulations or regulatory policies or supervisory guidance, including changes in interpretation or implementation of statutes, regulations, policies or supervisory guidance, could affect the Company in substantial and unpredictable ways. Additional regulation and supervision has increased, and may continue to increase, the Company’s costs and limit its ability to pursue business opportunities. Further, the Company’s failure to comply with these laws and regulations, even if the failure was inadvertent or reflects a difference in interpretation, could subject it to restrictions on its business activities, fines and other penalties, any of which could adversely affect the Company’s results of operations, capital base and the price of its securities. Further, any new laws, rules and regulations could make compliance more difficult or expensive or otherwise adversely affect the Company’s business and financial condition.

Changes in accounting standards could impact reported earnings.

The authorities that promulgate accounting standards, including the FASB, the SEC and other regulatory authorities, periodically change the financial accounting and reporting standards that govern the preparation of the Company’s Consolidated Financial Statements. These changes are difficult to predict and can materially impact how the Company records and reports its financial condition and results of operations. In some cases, the Company could be required to apply a new or revised standard retroactively, resulting in the restatement of financial statements for prior periods. Such changes could also require the Company to incur additional personnel or technology costs.

The Company is subject to laws regarding the privacy, information security and protection of personal information and any violation of these laws or another incident involving personal, confidential or proprietary information of individuals could damage the Company’s reputation and otherwise adversely affect its business.

The Company’s business requires the collection and retention of large volumes of customer data, including PII in various information systems that the Company maintains and in those maintained by third party service providers. The Company also maintains important internal company data such as PII about its employees and information relating to its operations. The Company is subject to complex and evolving laws and regulations governing the privacy and protection of PII of individuals (including customers, employees and other third-parties). For example, the Company’s business is subject to the Gramm-Leach-Bliley Act of 1999, which, among other things: (i) imposes certain limitations on the Company’s ability to share nonpublic PII about its customers with nonaffiliated third parties; (ii) requires that the Company provides certain disclosures to customers about its information collection, sharing and security practices and affords customers the right to “opt out” of any information sharing by it with nonaffiliated third parties (with certain exceptions); and (iii) requires that the Company develops, implements and maintains a written comprehensive information security program containing appropriate safeguards based on the Company’s size and complexity, the nature and scope of its activities, and the sensitivity of customer information it processes, as well as plans for responding to data security breaches. Various federal and state banking regulators and states have also enacted data breach notification requirements with varying levels of individual, consumer, regulatory or law enforcement notification in the event of a security breach. Ensuring that the Company’s collection, use, transfer and storage of PII complies with all applicable laws and regulations can increase the Company’s costs. Furthermore, the Company may not be able to ensure that customers and other third parties have appropriate controls in place to protect the confidentiality of the information that they exchange with the Company, particularly where such information is transmitted by electronic means. If personal, confidential or proprietary information of customers or others were to be mishandled or misused, the Company could be exposed to litigation or regulatory sanctions under privacy and data protection laws and regulations. Concerns regarding the effectiveness of the Company’s measures to safeguard PII, or even the perception that such measures are inadequate, could cause the Company to lose customers or potential customers and thereby reduce its revenues. Accordingly, any failure, or perceived failure, to comply with applicable privacy or data protection laws and regulations may subject the Company to inquiries, examinations and

28

investigations that could result in requirements to modify or cease certain operations or practices or in significant liabilities, fines or penalties, and could damage the Company’s reputation and otherwise adversely affect its operations, financial condition and results of operations.

The Company’s business and earnings are impacted by governmental, fiscal and monetary policy over which it has no control.

The Company is affected by domestic monetary policy. The Federal Reserve regulates the supply of money and credit in the United States, and its policies determine in large part the Company’s cost of funds for lending, investing and capital raising activities and the return it earns on those loans and investments, both of which affect the Company’s net interest margin. The actions of the Federal Reserve also can materially affect the value of financial instruments that the Company holds, such as loans and debt securities, and also can affect the Company’s borrowers, potentially increasing the risk that they may fail to repay their loans. The Company’s business and earnings also are affected by the fiscal or other policies that are adopted by various regulatory authorities of the United States. Changes in fiscal or monetary policy are beyond the Company’s control and hard to predict.

Risks Related to the Company’s Common Stock

The Company is not obligated to pay dividends and its ability to pay dividends is limited.

The Company’s ability to make dividend payments on its common stock depends primarily on certain regulatory considerations and the receipt of dividends and other distributions from the Bank. There are various regulatory restrictions on the ability of banks, such as the Bank, to pay dividends or make other payments to their holding companies. The Company is currently paying a quarterly cash dividend to holders of its common stock at a rate of $0.36 per share. Although the Company has paid a quarterly cash dividend to the holders of its common stock since July 2013, holders of its common stock are not entitled to receive dividends, and the Company is not obligated to pay dividends in any particular amounts or at any particular times. Regulatory, economic and other factors may cause the Company’s Board to consider, among other things, the reduction of dividends paid on its common stock.

Future issuances of the Company’s common stock could adversely affect the market price of the common stock and could be dilutive.

The Company’s Board, without the approval of shareholders, could from time-to-time decide to issue additional shares of common stock or shares of preferred stock, which may adversely affect the market price of the shares of common stock and could be dilutive to the Company’s shareholders. Any sale of additional shares of the Company’s common stock may be at prices lower than the current market value of the Company’s shares. In addition, new investors may have rights, preferences and privileges that are senior to, and that could adversely affect, the Company’s existing shareholders. For example, preferred stock would be senior to common stock in right of dividends and as to distributions in liquidation. The Company cannot predict or estimate the amount, timing, or nature of its future offerings of equity securities. Thus, the Company’s shareholders bear the risk of future offerings diluting their stock holdings, adversely affecting their rights as shareholders, and/or reducing the market price of the Company’s common stock.

An investment in the Company’s common stock is not an insured deposit.

The Company’s common stock is not a bank deposit and, therefore, it is not insured against loss by the FDIC or by any other public or private entity. An investment in the Company’s common stock is inherently risky for the reasons described in this “Risk Factors” section and elsewhere in this report and is subject to the same market forces that affect the price of common stock in any company and, as a result, shareholders may lose some or all of their investment.

The Company qualifies as a “smaller reporting company,” and the reduced disclosure obligations applicable to smaller reporting companies may make its common stock less attractive to investors.

The Company is a “smaller reporting company” as defined in federal securities laws. Smaller reporting companies have reduced disclosure obligations, such as an exemption from providing selected financial data and an ability to provide simplified executive compensation information and only two years of audited financial statements. If some investors find the Company’s common stock less attractive because the Company may rely on these reduced disclosure obligations, there may be a less active trading market for its common stock and its stock price may be more volatile.

29

While the Company’s common stock is currently listed on the Nasdaq Capital Market, it has less liquidity than stocks for larger companies listed on national securities exchanges.

The trading volume in the Company’s common stock on the Nasdaq Capital Market has been relatively low when compared with larger companies listed on national securities exchanges. There is no assurance that a more active and liquid trading market for the common stock will exist in the future. Consequently, shareholders may not be able to sell a substantial number of shares for the same price at which shareholders could sell a smaller number of shares. In addition, the Company cannot predict the effect, if any, that future sales of its common stock in the market, or the availability of shares of common stock for sale in the market, will have on the market price of the common stock. Sales of substantial amounts of common stock in the market, or the potential for large amounts of sales in the market, could cause the price of the Company’s common stock to decline, or reduce the Company’s ability to raise capital through future sales of common stock.

General Risk Factors

The Company is exposed to risk of environmental liabilities with respect to properties to which it takes title.

In the course of its business, the Company may foreclose and take title to real estate, potentially becoming subject to environmental liabilities associated with the properties. The Company may be held liable to a governmental entity or to third parties for property damage, personal injury, investigation and clean-up costs or the Company may be required to investigate or clean up hazardous or toxic substances or chemical releases at a property. Costs associated with investigation or remediation activities can be substantial. If the Company is the owner or former owner of a contaminated site, it may be subject to common law claims by third parties based on damages and costs resulting from environmental contamination emanating from the property. These costs and claims could adversely affect the Company’s business.

Severe weather, earthquakes, other natural disasters, pandemics, endemics, acts of war or terrorism and other external events could significantly impact the Company's business.

Severe weather, earthquakes, other natural disasters, pandemics, acts of war or terrorism and other adverse external events could have a significant impact on the Company's ability to conduct business. Such events could affect the stability of the deposit base, impair the ability of borrowers to repay outstanding loans, impair the value of collateral securing loans, cause significant property damage, results in loss of revenue and/or cause the Company to incur additional expenses. Although management has established disaster recovery policies and procedures, the occurrence of any such events could have a material adverse effect on the Company's business, financial condition and results of operations.